Exhibit 7 - Information Security & Privacy Requirements (1).pdf

This is an Information Security & Privacy Requirements exhibit for a California state contract related to Splunk software maintenance and annual renewal. The document establishes the security and privacy standards that the contractor must implement and maintain throughout the contract term. Key requirements include compliance with applicable federal and state information security regulations, data protection standards, and privacy laws governing the handling of state and sensitive information. The contractor must implement security controls across all systems, networks, and applications used to support the contract, including encryption standards, access controls, audit logging, and incident response procedures. The exhibit specifies that the contractor is responsible for protecting confidential information, personal data, and state intellectual property in accordance with California state law and any federal requirements applicable to the services being provided.

The exhibit further mandates that the contractor conduct regular security assessments, vulnerability testing, and compliance audits to ensure ongoing adherence to established security baselines. The contractor must maintain documentation of all security controls, provide evidence of compliance upon request, and immediately notify the state of any security breaches or unauthorized access to protected information. Background check requirements for contractor personnel with access to sensitive systems or data are specified, and the contractor must implement training programs to ensure staff awareness of information security and privacy obligations. The contractor is required to cooperate fully with state audit activities and provide the state with the right to inspect and monitor security practices at any time during the contract period.